Unit 42 finds attacks targeting Google-synced passkeys on Windows

Researchers at Palo Alto Networks’ Unit 42 have identified three attacks against Google Password Manager’s synced passkeys on Windows, highlighting implementation risks in cloud-synchronized passkeys rather than weaknesses in passkey cryptography.

Unit 42 says the attacks exploit Google’s device trust, onboarding, and cloud authenticator implementation.

The researchers describe them as Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, with each targeting a different assumption about how synced passkeys are protected.

Pass-ta-key targets the device identity key that tells Google’s cloud authenticator that the request is coming from a trusted computer.

According to the researchers, malware running with user privileges can use wrapped key material stored in the local passkey state to generate a valid authentication request.

The attack produces a WebAuthn authentication assertion without the user verification (UV) flag.

Unit 42 found different outcomes among the services tested. For instance, GitHub rejected the attack because the required UV signal was absent. But eBay accepted the assertion despite requesting user verification.

eBay subsequently changed its implementation to validate the flag correctly, according to the researchers.

Silver Pass-ta-key overcomes that limitation.

Unit 42 says malware can force Chrome to re-onboard the device and register a new key that cloud authenticator treats as evidence that the user completed Windows Hello verification.

This can allow the attacker to produce assertions with the UV flag set without reproducing the user’s biometric or PIN.

Golden Pass-ta-key targets the security domain secret (SDS), which Unit 42 describes as a 32-byte symmetric master secret used to protect the private keys.

The researchers found the SDS displayed in plaintext in Chrome’s FIDO diagnostic logs during registration with Google’s cloud authenticator.

Google removed the value from those logs after Unit 42 reported the issue. But the researchers say Chrome still receives the SDS during device enrollment.

Pass-ta-key and Silver Pass-ta-key rely on cloud authenticator to produce valid assertions using credentials associated with the victim. But Golden Pass-ta-key allows the attacker to obtain the private keys in a portable form.

Unit 42’s findings do not show that an attacker can break public key cryptography passkeys.

The researchers do not extract a private key from the public key stored by a website, forge a signature without access to trusted key material, or identify a weakness in the WebAuthn challenge response protocol.

The attacks exploit systems responsible for storing, synchronizing, and using passkey credentials. Unit 42 says the findings expose gaps between the security assumptions around passkeys and their implementation.

FIDO Alliance has pushed back against broad claims that attacks involving compromised browsers or endpoints mean passkeys themselves are broken.

The findings do not show that passkeys or WebAuthn cryptography are broken. Instead, they target the systems responsible for storing, synchronizing and presenting passkey credentials on compromised endpoints. The research reinforces FIDO Alliance’s longstanding position that organizations should evaluate both the security of passkey providers and the devices on which synchronized credentials are stored, particularly for higher-assurance use cases.

Article Topics

cybersecurity  |  Palo Alto Networks  |  passkeys  |  Windows